Build & deploy · 5 min read
Developer: API, webhooks & embed
Keys and REST endpoints, signed booking events, and the embeddable widget.
BraveDay is API-first: everything the UI does, it does through the same endpoints you can call. Use the REST API to read and write bookings, event types, and availability; webhooks to react to events; and the embed widget to put booking on your own site.
API keys
- Go to Settings → Developer and create an API key.
- Send it as a bearer token: Authorization: Bearer <key>.
- Call the /api/v1 endpoints for bookings, event types, availability, and more.
Webhooks
Register an endpoint URL and subscribe to booking.created, booking.rescheduled, and booking.cancelled. Each delivery is signed with an HMAC-SHA-256 signature over a timestamped body (Stripe-style), so you can verify authenticity and reject replays. Deliveries retry with backoff and record their terminal status.
Embed
Drop the booking widget onto your own page so people book without leaving your site. The public booking pages are also just URLs, so you can link or iframe them anywhere.
Tip
Webhook consumer URLs are validated against internal IP ranges and pinned to the resolved public IP (defeating DNS-rebinding), and redirects aren't followed. Point them only at endpoints you control.
Related guides
Ready to try it? Get started free, or browse all guides.